WordPress VikBooking Hotel Booking Engine & PMS plugin 1.8.8-1.8.14 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by anhdung1329 in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions 1.8.8-1.8.14...

EUVD-2026-82667

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

CVE-2026-85127: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-71801

CVE-2026-71801 affects s-pms SPMS-Server through v1.0 . The root cause is a hardcoded default access token secret in the application's core configuration file that is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid admini...

EUVD-2026-75162

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

PT-2026-89150

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-71801: Use of Hard-coded Credentials

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-70830

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61781

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2025-9211

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting...

CVE-2025-9211 Cross-site scripting in Otalio Ship Property Management System

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting...

EUVD-2025-210738

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2025-9210 Missing JSON Web Token signature validation in Otalio Ship Property Management System

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2025-9210 Missing JSON Web Token signature validation in Otalio Ship Property Management System

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

PT-2026-77276

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting...

PT-2026-77275

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2026-15346: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-15401: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...